2acfa669dce5852ee979edae56d7d6cef2a8027ba9083f6145ec7d63cd5e61f4

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 23:19

Target

ssleay32.dll
Size

368KB
MD5

2da6e9df4979ca65a01c4df6eb5600d2
SHA1

8bb90aca4e3387629e76d5c8cb53743990d891ec
SHA256

bfb7a9a4d5501d21cd575ec6f65b10ec3d43e6bc137d7b6469daf24ee0b65d14
SHA512

e146c42fee06702b80ca46d7a281a8c0600b9a35213accac29dc3c505d9d1f0405c4a69f22258042fbe4d35278c2c47ba878b1f2bfaa739eb1501428ea5f90af
SSDEEP

6144:tS4YNV1eN5+tEmD24Y3m5staz+5UGhB5v7gwOmnpRt+i0QKYU6PuCv7CNbA2WQzY:1YNV1eN5+tEmD24Y3m5stazIUGhB5jgm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4988	2624	rundll32.exe	82
PID 2624 wrote to memory of 4988	2624	rundll32.exe	82
PID 2624 wrote to memory of 4988	2624	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ssleay32.dll,#1
  2⤵
  PID:4988

memory/4988-1-0x00000000024F0000-0x0000000002663000-memory.dmp

Filesize
1.4MB

Download